# vex Published articles for vex. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Going deep: Upstream distros and hidden CVEs DevFeed: [Going deep: Upstream distros and hidden CVEs]() Original publisher: [Read original article]() Published: 2026-02-25T00:00:00Z Content type: opinion Language: en Sources: [Chainguard: Unchained]() Topics: [Docker Hardened Images](), [supply-chain-security](), [container images](), [Vulnerabilities](), [Debian](), [Docker]() Tags: [chainguard-containers](), [debian](), [debian-containers](), [dhi](), [docker](), [docker-containers](), [docker-hardened-images](), [security](), [supply-chain](), [supply-chain-security](), [vex](), [vulnerabilities](), [zero-cves]() ### AI overview The article argues that container vendors relying on upstream distributions such as Debian or Alpine can inherit vulnerabilities because fixes may lag between upstream availability and downstream image releases. It examines Docker Hardened Images and claims that some CVEs are suppressed through no-DSA classifications and VEX documents even when fixes exist upstream but have not been incorporated into the images. ### Source excerpt Are all zero-CVE images truly secure? A deep dive into Debian no-DSA, VEX suppression, and why transparency matters in container supply chain security. ## Grype Adds OpenVEX Support for Vulnerability Analysis DevFeed: [Grype Adds OpenVEX Support for Vulnerability Analysis]() Original publisher: [Read original article]() Published: 2023-10-10T00:00:00Z Content type: tutorial Language: en Sources: [Chainguard: Unchained]() Topics: [grype](), [openvex](), [supply-chain-security](), [vulnerability management](), [anchore](), [chainguard](), [Security]() Tags: [anchore](), [chainguard](), [cve](), [cybersecurity-and-infrastructure-security-agency](), [grype](), [openssf](), [openvex](), [scanner](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [vex](), [vulnerability-management](), [vulnerability-scanner]() ### AI overview Grype, Anchore's open-source vulnerability scanner, now supports OpenVEX, a machine-readable standard for vulnerability analysis. The article explains how this can provide context for vulnerabilities and help reduce false positives and vulnerability-management effort. ### Source excerpt Open source vulnerability scanner Grype has added support for OpenVEX, making software supply chain security easier. Learn how to implement it today. ## Why Chainguard uses Grype as its first line of defense for CVEs DevFeed: [Why Chainguard uses Grype as its first line of defense for CVEs]() Original publisher: [Read original article]() Published: 2023-10-06T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [grype](), [chainguard](), [Vulnerabilities](), [Security](), [Open Source](), [chainguard images](), [container images](), [Go](), [trivy]() Tags: [chainguard](), [chainguard-images](), [container-images](), [cve-remediation](), [cves](), [false-negative](), [false-positive](), [go](), [grype](), [open-source](), [prisma-cloud](), [sbom](), [security](), [snyk](), [trivy](), [vex]() ### AI overview Chainguard explains why it selected Grype as the foundation of its internal vulnerability detection system. The article describes scanning early in the software delivery pipeline, using Grype as a Go library to scan Wolfi APK packages before container images are built, and contributing vulnerability data and improvements to the open-source project. It also briefly compares Grype's open data pipeline with Trivy's. ### Source excerpt Chainguard harnesses Grype's open-source power to ensure minimal CVEs in images, prioritizing user security. ## Working with government and industry to put open source security tooling into practice DevFeed: [Working with government and industry to put open source security tooling into practice]() Original publisher: [Read original article]() Published: 2023-09-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard](), [open-source-security](), [software bill of materials](), [supply-chain-security](), [Tooling](), [cisa](), [Docker Hardened Images]() Tags: [bombshell](), [chainguard](), [cisa](), [cyclonedx](), [open-source](), [open-source-security](), [protobom](), [sbom](), [security](), [software-bill-of-materials](), [software-supply-chain-security](), [spdx](), [vex]() ### AI overview Chainguard describes two open-source SBOM tools developed with the U.S. Department of Homeland Security and other startups: protobom, which translates SBOM data between formats, and bomshell, which combines and composes SBOMs. The initiative aims to improve software supply chain security and visibility. ### Source excerpt Pioneering SBOM tools with government and industry allies, Chainguard advances open source security measures. ## Celebrating 5 years of NTIA's SBOM work DevFeed: [Celebrating 5 years of NTIA's SBOM work]() Original publisher: [Read original article]() Published: 2023-06-07T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [supply-chain-security](), [Cybersecurity](), [Security](), [chainguard](), [cisa](), [distroless]() Tags: [chainguard](), [cisa](), [cybersecurity](), [distroless](), [fedramp](), [openvex](), [sbom](), [software-bill-of-materials](), [software-dark-matter](), [software-supply-chain](), [software-supply-chain-security](), [sofware-supply-chain](), [ssdf](), [vex](), [vulnerability-scanning]() ### AI overview The article commemorates five years of the NTIA's Software Bill of Materials work and reviews the development of SBOMs as a foundation of software supply chain security. It describes the NTIA's initiative, its multi-stakeholder guidelines, and CISA's continuing role in advancing software transparency. ### Source excerpt Celebrate 5 transformative years of SBOM work with Chainguard, reflecting on the journey of software bill of materials. ## Chainguard to accelerate VEX adoption through OpenVEX specification DevFeed: [Chainguard to accelerate VEX adoption through OpenVEX specification]() Original publisher: [Read original article]() Published: 2023-01-31T00:00:00Z Content type: release Language: en Sources: [Chainguard: Unchained]() Topics: [openvex](), [chainguard](), [supply-chain-security](), [anchore](), [Vulnerabilities]() Tags: [anchore](), [chainguard](), [chainguard-images](), [cyclonedx](), [false-positives](), [google](), [images](), [linux-foundation](), [openvex](), [sbom-vex](), [scanners](), [security](), [software-supply-chain](), [spdx](), [supply-chain](), [vex](), [vulnerabilities](), [vulnerability](), [vulnerability-tool](), [wolfi]() ### AI overview Chainguard announces the OpenVEX specification and reference toolchain, developed with industry and CISA VEX Working Group collaboration. OpenVEX helps software producers describe vulnerability exploitability and enables consumers to filter false positives, complementing SBOMs. ### Source excerpt VEX needs the industry to come together to build formats that integrate into existing practices. OpenVEX enables organizations to put VEX into practice.